> We think the issue might not be severe enough [...]
It might not? In other words, if a security vulnerability is reported, assume everything is actually fine until proven exploitable beyond any shadow of a doubt?
> That is probably based on the idea that any local attack is going to end up being a complete compromise of the end point ... which is not an unreasonable assumption.
It's absolutely unreasonable.
If my endpoint is compromised, should I assume my key is potentially violated, and so change it? Yes
But should I assume that everything in my life is tainted and therefore pre-emptively expose all my secrets to attackers immediately? Of course not.
>> We always have to assume worst case for security vulnerabilities, it's kind of the whole job of being a security researcher to determine what could have happened.
Many people will be annoyed by this "assume the worst" drama.
For example, drinking too much water, if we assume the worst, can kill you.
Also, walking around can kill you, if we assume the worst.
Also, just being around can kill you, if we assume the worst, hey, you could die of a stroke.
So, how is this "assume the worst" statement useful?
To be precise: If it works as described, it makes it (a little? substantially? orders of magnitude?) more difficult for third parties to modify the code.
> When you consider the potential implications, and possible scenarios, from a security perspective you have to assume that they're not just "possible" but a reality.
No you don't. You definitely don't want to assume otherwise and you spend the time derisking and investigating, but if you have zero evidence to support the situation you don't just consider it the case anyways.
They admit they do not have enough information to determine the cause, yet they suggest there is little security risk. They can either not know or not know, but not both at the same time.
It might not? In other words, if a security vulnerability is reported, assume everything is actually fine until proven exploitable beyond any shadow of a doubt?
reply